CVE-2010-4075: Infoleak
Description of problem: The TIOCGICOUNT device ioctl in serialcore.c allows unprivileged users to read uninitialized stack memory, because the "reserved" member of the serialicounterstruct struct declared on the stack is not altered or zeroed before being copied back to the user.
Reference: http://www.openwall.com/lists/oss-security/2010/10/06/6 http://lkml.indiana.edu/hypermail//linux/kernel/1009.1/03388.html
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Other sources
The uartgetcount function in drivers/serial/serialcore.c in the Linux kernel before 2.6.37-rc1 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4075?
CVE-2010-4075 is classified as a high-severity vulnerability due to the potential exposure of sensitive stack memory to unprivileged users.
How do I fix CVE-2010-4075?
To fix CVE-2010-4075, update the Linux kernel to version 2.6.37 or later.
What type of systems are affected by CVE-2010-4075?
CVE-2010-4075 affects systems running vulnerable versions of the Linux kernel prior to 2.6.37.
What is the impact of exploiting CVE-2010-4075?
Exploitation of CVE-2010-4075 allows an unprivileged user to read uninitialized stack memory, potentially leaking sensitive information.
Is CVE-2010-4075 a remote or local vulnerability?
CVE-2010-4075 is a local vulnerability that requires an attacker to have local access to the system.